Extracted

• • Target

    conn.exe

  • Size

    28.3MB

  • MD5

    aea933c96f19820cf4ddb4b974f76939

  • SHA1

    053168caa514160c842bcc0c3571ca69ae688ed9

  • SHA256

    cce8c99583f06981073f0854a500d749c2e173676d06f121a70951d9b935fb28

  • SHA512

    7d35900e74414c77aa17546de4e4bb4c6e8023297bda40a3a8c1c6fbc1206684f6c8005509f96a46c7f539bb301375c86997953ec941c7dc9fb59fcfdd159e65

  • SSDEEP

    786432:Ttu0coshxWHVn6s6b64G71jaoCo1HagXykT2OGnMD9S:Bu0jyC6Fb6V71JCo1lJmE

  Score

  10^/10

  xwormdiscoveryexecutionpersistencerattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1